Pure ROUTING on FORTIGATE 60D

[architrave]

Hello, I would like to know if is it possible to configure on my Fortigate 60D on Internal network 4 different LAN and allow all traffic through these. 172.16.0.0/24 172.17.0.0/24 192.168.1.0/24 10.0.0.0/24 Thanks in advance Best Regards

[Jonathan_Rennie_FTNT]

Hi Architrave, Absolutely, this is possible and the best document to help you is probably.. http://docs.fortinet.com/uploaded/files/2029/connecting-a-private-network-to-the-Internet-using-NAT-Route-mode.pdf the 60D comes with all seven of the lan ports connected to an interface called internal (essentially it is one untagged VLAN) so you might want to change the mode of these ports on the CLI before you start configuring so that each port can easily be configured in a different subnet... config system global set internal-switch-mode interface end

[Jan_Scholten]

config system global set internal-switch-mode interface end

will probably not work as long as there is anything associated with internal port (DHCP and Firewall policy it was in the past) Afterwards it will reboot coming back with seperate ports. You can also create a trunk (802.1q tagged valsn on one interface), not sure whther this works with a internal switch so you can use DMZ, WAN1 or WAN2 for that (remember: This are only names). -> System ->interfaces - and hit " create" here you can enter you vlan ID give your FGT IP Adresses in each network, create policys from Network A -> B and B -> A and so on.. Fortigate will route the packets (but you need policys!)

[ShrewLWD]

Assuming you don' t want to VLAN and tag, and assuming you want to keep the internal in switch mode; Take an IP from each one of those ranges. Add the first IP as the primary IP address of internal. Add the rest as secondary IPs Give each range an address name Create specific rules for each SourceINT.....SourceAddress.....DestinationINT.....DestinationIP internal ..... range1 ..... wan1 ..... all internal ..... range2 ..... wan1 ..... all If you want them to communicate with each other, use hairpin rules; SourceINT.....SourceAddress.....DestinationINT.....DestinationIP internal ..... range1 ..... internal ..... range2 internal ..... range2 ..... internal ..... range1

[bungee75]

You can do that. You need to create policy where you allow traffic between these networks (interfaces) and check off the NAT. It will create routing rule.

You can even put multiple sources and destinations in the policy so you don't need to create multiple policies for that.